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Abstract 

In key management schemes that realize secure multicast communications encrypted by group keys 
on a public network, tree structures are often used to update the group keys efficiently. Selcuk and Sidhu 
have proposed an efficient scheme which updates dynamically the tree structures based on the withdrawal 
probabilities of members. In this paper, it is shown that Selguk-Sidhu scheme is asymptotically optimal 
for the cost of withdrawal. Furthermore, a new key management scheme, which takes account of key 
update costs of joining in addition to withdrawal, is proposed. It is proved that the proposed scheme 
is also asymptotically optimal, and it is shown by simulation that it can attain good performance for 
nonasymptotic cases. 

Index Terms 

Multicast communication, Key management schemes, Logical key hierarchy scheme, Selcuk-Sidhu 
scheme 

I. Introduction 

In the multicast communication of a group on a public network, a group secret key is often used 
to realize secure communication. But, when a member joins and/or withdraws from the group, a new 
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group key must be redistributed. 

The Logical Key Hierarchy (LKH) scheme, which was independently proposed by Wallner-Harder- 
Agee [1] and Wong-Gouda-Lam [2] in 1997, is a scheme with a tree structure that can renew the group 
key securely and efficiently when a member changes. Poovendran and Baras [3] analyzed the LKH 
scheme information-theoretically by considering the withdrawal probability of members in the scheme. 
Furthermore, Selcuk and Sidhu [4] have proposed a more efficient scheme such that a tree structure is 
dynamically updated based on the withdrawal probabilities of members. They analyzed the performance 
of their scheme information-theoretically. But, their evaluation is very loose. 

In this paper, we derive an asymptotically tight upper bound of the key update cost in Selcuk-Sidhu 
scheme. More precisely, the key update cost is O(logn) when a group has n members, and our upper 
bound is tight within a constant factor which does not depend on n. Furthermore, we propose a new 
dynamical key management scheme, which takes account of key update costs for joining in addition to 
withdrawal. We show that the proposed scheme is also asymptotically optimal. Moreover, it is shown by 
simulation that in nonasymptotic cases, the proposed scheme is more efficient than Selcuk-Sidhu scheme 
for joining while it is almost as efficient as Selcuk-Sidhu scheme for withdrawal. 

In this paper, we assume that channels are noiseless and public. Hence, any information sent over 
the channels may be wiretapped by adversaries who may be inside or outside of the group. Each member 
has a private key and several subgroup keys in addition to a group key. The subgroup key and group key 
are shared by the members of a subgroup and the group, respectively. The group key is used to encrypt 
secret messages to communicate among the group. On the other hand, the private key and subgroup keys 
are used when the keys must be updated by the change of members. 

Furthermore, we suppose the following in this paper. A reliable server, who has all the keys in the 
group, updates and distributes new keys when a member changes. The number of members in the group 
is sufficiently large, and the frequency of joining and withdrawal is relatively large. The key update 
cost is evaluated by the number of keys that must be updated when a member changes. To keep the 
security of communication, the key management scheme needs to meet the so-called Forward Security 
and Backward Security, which are defined as follows. 

> [Forward Security] A member who withdraws from a group cannot decrypt any data that will be 

sent in the group after the withdrawal. 
• [Backward Security] A member who joins a group cannot decrypt the data that were sent in the 

group before the joining. 

In Section II, Selcuk-Sidhu scheme is reviewed, and the performance of the scheme is evaluated 
precisely in Section III. Furthermore, in Section IV, Selcuk-Sidhu scheme is extended to consider the 
cost of joining. Finally, some simulation results are shown in Section V. 
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II. SELCUK-SlDHU SCHEME 

The LKH scheme [1], [2] can be represented by a binary tree such that each member of a group 
corresponds to each leaf of the tree while the root, each internal node, and each leaf also correspond to 
the group key, a subgroup key, and a private key, respectively. Each member holds all the keys on the 
path from the root to the leaf of the member in the tree. Each internal node makes a subgroup which 
consists of the descendants of the node, and the subgroup can communicate securely against any other 
members not included in the subgroup by using the subgroup key. In the multicast communication of the 
group, the group key is used to realize secure communication. But, when a member joins or withdraws 
from the group, the subgroup keys and private keys are used to update the keys. Note that in order to 
keep security, it is necessary to update all the keys on the path from the root to the leaf of the member. 

For the LKH scheme, Poovendran and Baras [3] introduced the withdrawal probabilities of members 
to analyze information-theoretically the average cost of key update in the case of the withdrawal. Let 
Q be a group and let Pm be the probability that a member M £ Q withdraws from the group within a 
certain period 1 . Pm is assumed to be given since it can be often estimated from the statistics and the 
personal data of the member. Pm satisfies < Pm < 1- But, note that 

Pg = P M, (1) 

Meg 

is usually not equal to one. Hence, we use the normalized withdrawal probability distribution V = 
{Pm/Pq : M G 0} to evaluate the performance. 

When a member withdraws from the group, the average withdrawal cost L and the average normalized 
withdrawal cost I are defined by 

L = P MdM, (2) 

Meg 

Meg G 

respectively, where d,M is the number of keys that must be updated when member M withdraws. We 
note that dig is equal to the depth of member M in the key tree of the LKH scheme. 

In the case of lossless source coding, I given by Q corresponds to the average code length for a fixed- 
to-variable length code (FV code) with probability distribution V and codeword length {(1m '■ M £ G}, 
and it is well known that the Huffman tree [5] is the best tree to minimize the average code length under 
the prefix condition. Furthermore, if the group is incremented and the probability distribution changes 
as the coding progresses, the optimal code tree can be kept by the dynamic Huffman coding algorithm 
[6] [7]. 

'in order to keep the system securely, all keys are usually renewed periodically. Hence, the period is finite and Pm < 1 for 
many members. 
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Fig. 1. Insertion of M by Insert(M, X). 



In the case of key management, the prefix condition is also required because the set of keys of each 
member must be different from that of others to keep security. Based on this observation, Poovendran 
and Baras have shown that in the case of key management, the Huffman tree is the best tree to minimize 
the average normalized withdrawal cost. However, if the key tree is updated by the dynamic Huffman 
coding algorithm to keep the key tree optimally, the key update cost cannot be minimized usually because 
the algorithm often changes the tree structure for many members besides a withdrawn member, and this 
causes additional key update costs. Hence, in the case of key management, it is better to keep the tree 
structure as unchanged as possible for non-withdrawn members. Based on this idea, Selguk and Sidhu 
[4] have proposed two key tree updating algorithms. 

In order to explain Selguk-Sidhu algorithms, we first define an operation Insert(M, X), which 
represents the insertion of a new member M at node X, i.e. a new node N is inserted between X 
and its parent node Y as shown in Fig. ^ an d A/ is linked as a child of N. 

For node X, let Px be the weight that is given by the sum of the withdrawal probabilities of all 
members included in the descendants of node X? Then, the first algorithm to update a key tree is 
described as follows. 

Algorithm 1 

Let M be a new member and let X be the root of a given key tree. 

1. If X is a leaf, then operate Insert (M,X) and exit. 

2. Let Xi and X r be the left and right children of X, respectively. If it holds that Pm > Px t and 
Pm > Px r > tnen operate Insert(M, X) and exit. 

3. If Px, > Px r , then let X <- X r . Otherwise, let X «- X h Go back to Step 1. 



2 If X is the root, Px is equal to Pg. 
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In order to describe the second algorithm, we first define the cost increase Cm,x for a new member 
M and a node X as follows [4]. 

C M ,x = (dx + l)PM + Px, (4) 

which represents the increase of cost L for the case that a new member M is inserted at node X. 
Let C m ; n be the minimum cost increase that is given by 

C m in = mmC M ,x- (5) 

Then, the second algorithm inserts a new member M at the node that can attain C m ; n . Formally, the 
second algorithm to update a tree key is defined as follows. 
Algorithm 2 

Let M be a new member . 

1) First calculate Cm,x for every node X, and obtain C m i n . Let X m ; n be the node that attains C m i n . 

2) Operate Insert(M, X m [ n ). 

It is shown by simulation in [4] that Algorithm 2 can attain less average withdrawal cost L than 
Algorithm 1. But, although Algorithm 1 can be implemented with O(logn) time complexity when 
\Q\ = n, i.e. the size of a group is n, Algorithm 2 requires 0(n) time complexity in the search of X m i n . 

Selcuk and Sidhu evaluated the average normalized withdrawal cost I for the case of Algorithm 1 
as follows 3 [4]. 

d M < K x {- log P M + log Pg) + K 2 , (6) 
I < K 1 H(V)+K 2 , (7) 
where H(V) is the entropy of the probability distribution V = {Pm/Pq '■ M <E Q}, and it is defined by 



Meg G G 



Ki and K 2 are constants given by 



where a = 



K x = wl.44, (9) 

log a 

K 2 = -1— log — w 0.672, (10) 

log a a 

2 ' 

We note from the source coding theorem for FV codes [8] that the average normalized withdrawal 
cost I must satisfy 

1>H{V). (11) 

3 In this paper, the base of log is 2. 
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Furthermore, it holds from Theorem ^ shown below that H(V) = O(logn) for \Q\ = n. Hence, the 
upper bound of / given by @ is not asymptotically tight as n becomes large. This result means that 
Algorithm 1 is not efficient or the upper bound is loose. In the next section, we will show that Algorithm 
1 is asymptotically optimal by deriving an asymptotically tight upper bound. 

Theorem 1 Assume that the maximum and minimum probabilities of withdrawal defined by 

P max = maxP M < 1, (12) 
Meg 

P min = min P M > (13) 

are fixed. Then, for n = \Q\, H(V) defined by (|8} satisfies 

H{V) = 0(logn). (14) 

Proof: Let e inin = Pmin/Pg, %ax = Pmax/Pg, and k = e miri /e max = P ro i n /Pmax- Then, H(V) 
can be bounded as follows. 

^ Pg Pg 

Meg y y 

(a) 

> ~ } J eminl0g£min 

Meg 

= ne min log — !— 



(&) e • 

V c mm n 

> log n 

^max 

= fclogn, (15) 

where inequalities (a) and (b) hold because of the following reasons. 

(a): — tlogt is monotonically increasing when t > is small. Furthermore, when n is sufficiently 

large and Pg 3> 1, we have that e m j n = < ^- < 1. 
(6): From the relation nP max > Pg > nP m i n , it holds that 

> w > 7^ = • (16) 



c min J min J max c max 



P ■ — — P 
J min ' - 

Similarly, we can easily show that 



H(V)<l\ogn. (17) 



Therefore, (I14t is obtained from H5\ and d!7i . 
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III. Detailed Analysis of Selcuk-Sidhu scheme 

In order to derive a tight upper bound for the key tree constructed by Algorithm 1, we use the 
following lemma. 

Lemma 1 Let X and S be sibling nodes each other in the key tree constructed by Algorithm ^ Then, 
it holds that 

\P X ~ Ps\ < Pmuc, (18) 

where P max is defined in l\2\ . 

Proof: The lemma can be proved by mathematical induction for the key tree with \Q\ = n. Let 
P [ x\ P { ™\ and PiTaL be P x , P s , and P max in the case of \Q\ = n, respectively. 

1. When n = 2, it holds that P^ < Pf ] = P^L or pl 2) < P^ ] = P^L- In the former case, we 
have < Pf ] - P|° < P^L Otherwise, < - P,l 2) < P^L Hence, GBJ holds - 

2. Supposed that 

\PW-PM\<PM (19) 

holds for every pair of sibling nodes (X, S) in the key tree with \Q\ = n, and the key tree is 
incremented to \Q\ = n + 1 by inserting a new member M with probability Pm according to 
Algorithm ^ Then, we have 

P^ = max{pW XI P M } > P<&. (20) 

We assume, without loss of generality, that Pg > P^. Then, from Algorithm ^ there may occur 
the following three cases. 
Case 1: M is inserted outside nodes X, S, and their descendants. 

In this case, it holds obviously that pj™ +1) = P^ n) and P^" +1) = P^ n) . Hence, we obtain from 

flj and m that \P { x n+1) - P { s n+1) \ < P^+ 1] . 
Case 2: M is inserted at node X as shown in Fig. ^ 

In this case, we have the new pairs of sibling nodes, (X,M) and (N,S), where N was the 

new parent node of X, and it holds from Step 2 of Algorithm ^ that [Pj^ < Pm < P§ or 

Pm < Px } < p s n) ] and i p M > Px?, Pm > Px?l where X t and X r are the children of X. 

Hence, from P^" +1) = and P^ n+1) = p| n) , we have that [p£ l+1) < P M < P ( s n+1) or 

Pm < P ( x +1) < P ( s n+1) ] and P^ +1) < 2P M . 

In the case of P^ +1) < P M , it holds that < P M -P^ +1) < p| n+1 )_p^+ 1 ) = p| n >-.pW < 
Pmax < Pmat^. Furthermore, in the case of P^ l+1) > P M , it holds that < P^" +1) - P M < 
2Pm ~ Pm = Pm < Ptk^ ■ 
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For the pair (N,S), we have that |P^" +1) - P^ n+1) | = |P| n+1) - P^" +1) - P M \ = \{P^ n) - 
4 n) ) ~Pm\< max{Pil, P M } - P4 n at 1} . 
Case 3: M is inserted at a descendant node of X. 

In this case, we have that P { s n+1] = P^ n) and P<f +1) = P^ n) + P M Hence, it holds that 

|P|" +1) - Pi n+1) | = |(P| n) - P&°) - Pm| < max{Pil, P M } - Pil^. 



Now, we evaluate the weight of the ancestors of an arbitrarily given node X in the key tree generated 
by Algorithm 1. Let nodes F and G be the parent and grandparent of X, respectively, and let U be the 
sibling of F. Then, we have from Lemma ^ that 

Pf = Px+Ps 

> 2P X -P max . (21) 

Furthermore, we have that 

P G = Pf + Pu 

> 2Pf — Pnax 

^ 2 Px 2P max Pmaxi (22) 

where the first and second inequalities holds from Lemma \l\ and i2l\ . respectively. By repeating the 
same procedure, we obtain that 

Pg > 2 dx P x -(2 dx - 1 + 2 dx - 2 + --- + 2 + l)P max 

= 2 rfx (P x -P max ) + P max , (23) 

where dx is the depth of node X. 

Therefore, the following theorem holds. 

Theorem 2 In the key tree constructed by Algorithm 1, the following relation holds for any node X 
and any leaf Mx that is a descendant of X. 



dx < log Pg + log I 1 - %i I - log(P x - P max ) (24) 



d ( M ] < K x {- log P M + log Px) + K 2l (25) 



where dj^P is the depth from node X to leaf M. 



Proof: (1241 and ( 125 > hold from \2'i\ and respectively. 
Next, we evaluate Px- 
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Lemma 2 Let Xi and X r be the children of node X. Assume that the weight of X is larger than a real 
number t but the weight of Xi is not larger than t, i.e. Px > t > Px, ■ Then, the following inequalities 
hold. 

t<P x <2t + P max (26) 

Proof: From l fT8l , we obtain that 

P X = P Xl + PX T < 2P Xl + Pmax < 2t + P max . (27) 

■ 

Let t(> P max ) be a parameter which will be optimized later. Now, for a given leaf M, we consider 
the node X that is the nearest ancestor of M under the condition Px > t. Then, from J24t . d25i . and 
I27L the depth djvf of leaf M can be bounded as follows. 

= dx + 

< logPg + log ^1 - - \0g(P X - Pmax) + K X (- log P M + log P X ) + X 2 

< log + log (\ - - Iog(t - P max ) 

(- log P M + log(2t + P max )) + K 2 (28) 

We can easily show for f(t) — — log(t — P ma x) + Ki log(2t + P ma x) that f(t) can be minimized 
at t = t m given by 

2 + log a 

< m = on , , « 4.405, (29) 
2(1 - log a) 

where a = ■ Note that if a key tree is sufficient large and efficiently constructed, there exists the 



node X that satisfies Px > t m > P ma x- Hence, by substituting t = t m into d28l > and some calculations, 
we obtain the following theorem. 

Theorem 3 When the key tree constructed by Algorithm 1 is sufficiently large, the depth dj^ of a leaf 
M in the key tree is upper bounded as follows. 

d M < log P G - K x log P M + {Ki - 1) log P max + log (l - + K a , (30) 

where K 3 is defined by 

31oga 1 / 3 , VE\ 

2(1 — log a) log a \ 1 — log a a / 

w 3.65. (31) 

By averaging d,M for all member in Q, the following theorem holds for the average normalized 
withdrawal cost /. 
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Theorem 4 When a key tree constructed by Algorithm 1 is sufficiently large, the average normalized 
withdrawal cost I of the key tree satisfies that 



Pmax , ( - Pna:< 



I < H(V) + (K 1 -l)log^+\og[l-^)+K 3 . (32) 



Proof: I can be evaluated as follows. 

Pm 
Pq 



1 = E ^w dM 

MG0 



< log Pg-^J^JT log Pm + {K x -l) log P max + log (l - ^ ) + K 3 

Meg G \ Q 

Meg G G Meg G 



-{Kx - 1) logP max + log ( 1 - %i ) + K 3 



= } log P g + K X H{V) - K x log Pg + ^-l) log P max + log (1 - %± I + K 3 



max 

= K X H{V) - (Jfi - 1) log P g + (A'i - 1) log P max + log [\ - ^ j + A 3 

< A X P(P) + {K x - 1) Mog - H{V)j + (Ki - 1) log P max + log ^1 - + K 3 

= ff(p) + (A 1 -l)log§^+logfl-%f£)+A 3 , (33) 
where equality (a) and inequality (6) hold from and the following lemma, respectively. ■ 

Lemma 3 H{V), Pg, and P m ; n satisfy that 

-logPg < log-^-P(P). (34) 
Pnin 

Proof: It is well known that the entropy H(V) is bounded by logn for \Q\ = n, and it holds 
obviously that Pg > nP m ; n . Hence, we obtain that 

H (V) - log Pg < log n - log (nP min ) = log (35) 

min 

■ 

We finaly note that in d32i . the coefficient of P(P) = O(logn) is one and the second and third 
terms are constants. Hence, Theorem 0] gives an asymptotically tight bound of I. 

IV. Extension of Selcuk-Sidhu scheme 

In Selcuk-Sidhu scheme [4], only the withdrawal cost of a new member is considered. But, the 
withdrawal cost is an expected cost in the future, which may not be occur. On the other hand, it is 
always necessary to update a key tree when a new member joins. Hence, in this section, we propose 
extended schemes of Algorithms 1 and 2 to consider the joining cost in addition to the withdrawal cost. 
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When a new member is inserted at the node X with depth dx, the withdrawal cost L increases by 
Cm x, which is given by (0}. But, at the same time, dx + 1 keys in the tree must be updated with 
probability one for the joining. Hence, the cost increase including the joining cost, say C* M x , can be 
given by 

C* M>X = (dx + l)P M + Px + l-(d x + l) (36) 
= (d x + l)(P M + l) + P x . (37) 

Comparing C* M x with Cm.x, we note that Pm in Cm,x is changed to Pm + 1 in C* M x . Hence, 
by substituting Pm + 1 into Pm in Algorithms 1 and 2, we can obtain the following algorithms which 
consider the joining cost. 
Algorithm 3 

Let M be a new member and let X be the root of a given key tree. 

1) If X is a leaf, then operate Insert(M, X) and exit. 

2) Let X[ and X r be the left and right children of X, respectively. If it holds that Pm + 1 > Pxi 
and Pm + 1 > Px r , then operate Insert(Af, X) and exit. 

3) If Px l > Px r , then let X <- X r . Otherwise, let X «- X t . Go back to Step 1. 
Algorithm 4 

Let M be a new member . 

1) First calculate C* M x for every node X, and obtain C^ in , where C* lin = minC^ x . Let X^ in be 
the node that attains C^ in . 

2) Operate Insert(M,X£ in ). 

For Algorithmic] the following theorem holds in the same way as Theorem |4] 

Theorem 5 When the key tree constructed by Algorithm 3 is sufficiently large, the average normalized 
withdrawal cost I of the key tree satisfies that 

I < J tf(P)+logF max + (K 1 -l)log(3F max + 5) 

-K X logP roin + E^±A + i og ( 1 P ™^ + 2 \ + K ^ m 

Miiin \ -ty / 

where K4 is defined as follows. 

ft - -(-!— l)l„ g (-J— ^-J-logMl (39, 
\ log a J \ log a J log a a log e 

w 3.95 (40) 

Proof: (The proof is given in the appendix.) ■ 
We note from Theorem [5] that the coefficient of H(P) in (I38i is also one although the constant terms 
are larger than d32i . This means that Algorithm 3 can also attain asymptotically optimal key tree for the 
withdrawal cost in addition to decreasing the joining cost. 
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TABLE I 

Average cases for Joining 



n 


100 


10, 000 


m 


100 


10, 000 


100 


10,000 


Aig.ni 


7.42 


7.32 


13.19 


14.14 


Alg.0 


7.53 


7.35 


14.23 


14.20 


Alg.0 


6.50 


6.23 


12.85 


13.12 


Alg.0 


6.51 


6.26 


13.02 


13.14 



TABLE II 

Average cases for Withdrawal 



n 


100 


10, 000 


m 


100 


10, 000 


100 


10, 000 


Aig.ni 


5.46 


5.51 


12.11 


12.19 


Alg.0 


5.39 


5.45 


12.03 


12.14 


Alg.0 


5.75 


5.76 


12.26 


12.33 


Alg.0 


5.57 


5.71 


12.13 


12.28 



V. Simulation Results 

In the previous sections, we showed that Algorithms 1 and 3 are asymptotically optimal and 
Algorithms 2 and 4 are expected to achieve more efficient performance than Algorithms 1 and 3, 
respectively, in the case of withdrawal. In this section, we evaluate the performances of Algorithms 
1-4 by simulation. 

We first construct the optimal tree, i.e., Huffman tree for a group with n members. Then, a new 
member joins the group each after a member withdraws from the group. Such joining and withdrawal 
are repeated m times. It is assumed that the withdrawal probability of a new member Pm is uniformly 
distributed in [0.1,0.9]. For this case, the average costs of joining and withdrawal are shown in Tables |U 
and HI] respectively. 

We note from the tables that Algorithms [3] and |4] can improve the cost of joining at a little increased 
cost of withdrawal. Algorithms |2] and |4] are more efficient than Algorithms C] and respectively, in the 
case of withdrawal. But the difference is not large, and Algorithms|2]and|4]require 0(n) time complexity 
although Algorithms [2and|3]can be implemented with O(logn) time complexity. Therefore, Algorithms 
[5] and |4] should be used in the cases of large n and small n, respectively. 

If the backward security described in section I is not required for a group, we don't need change any 
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group and subgroup keys when a new member joins the group. Hence, it is preferable to use Algorithms 
[I] or |2 in such a case. 

Appendix 

A. The proof of Theorem \5\ 

For the key tree constructed by Algorithm [5] the following lemma holds. 

Lemma 4 Let X and S be sibling nodes each other in the key tree constructed by Algorithm [5] Then, 
it holds that 

\Px~Ps\ <f m ax + 2, (41) 

where P max is defined in dl 2t . 

Proof: The lemma can be proved in the same way as Lemma ^ ■ 
Now, for a give leaf M, let nodes X and Y be ancestors of M such that Y is an ancestor of X, 
Px > 1, and Py > P max + 2. When \Q\ = n is sufficiently large, there always exist such nodes X and 
Y. We represent the depths from the root to node Y , from node Y to node X, and from node X to leaf 

(Y) { X) 

M by dy, d x , > respectively, which satisfy that 

d M = dy + d { p + d[f . (42) 

Then, by using Lemma |4j we can prove in the same way as i24\ and d25l that 

dy < log Pg + log (\ - Pl °p g +2 ) - log(^ " Pnax - 2), (43) 

< ^i[-log(Px-l)+log(Py-l)]+X 2 . (44) 
Furthermore, d M obviously satisfies that 



4?<^-l- (45) 



Let real numbers £ > P max + 2 and s > 1 be parameters which will be optimized later. For given 
(t, s), we select nodes X and Y such that X is the nearest ancestor of M under the condition Px > s 
and Y is the nearest ancestor of X under the condition Py > t. Then, in the same way as &26\ . we can 
show that 

a < Px < 2s + P max + 2, (46) 
t<P Y <2t + P max + 2. (47) 
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By combining (1421 — (I47i . we obtain the following bound of d 



d M < log Pg + log ^1 - J - log(JV - ^max - 2) 

+K,[- log(P X - 1) + log(Py -l)]+K 2 + ^--l 

J min 



< log Pg + log ^1 - 1 - log(t - P max - 2) 

+K, [- log(s - 1) + log(2t + P max + 1)] + K 2 + 2s + p max + 2 - 1 (48) 

Mnin 



Letting 



g(t) = -log(i-P max -2) + X 1 log(2t + P max + l), (49) 
h(s) = -KMa-l) + -^-, (50) 

-*inin 

we can easily show that g(t) and h(s) are minimized at t = t m and s — s m , respectively, which are 
given by 



^"tn 



(2 + log a)P max + 4 + loga 
2(1 -log a) 

« <mP„ax + 7.676, (51) 
_ loge 
2 log a 

« 1.040P min + L (52) 

where t m ps 4.405 is defined in (I29i . By substituting f = t m and s = s m into (I48> . we can obtain after 
some calculations that 

d M < log Pg + iKr-1) log(3P max + 5) - Ki log P min 

-Pmax "I" 4 / Pnax 2 \ 

+ — ^ + log II )+K 4 , (53) 

where is defined in J39I . 

Since the average normalized withdrawal cost I is the average of dm, I is bounded as follows. 

Meg g 

< log Pg + {Kx - 1) log(3P max + 5) - K x log P mi „ + Pm " x + 4 + log (l - Pma * + 2 ) + K 4 

Pnin V "Q J 



< H{V)+ log P max + [Kt - 1) log(3P max + 5) - K x log P 

iax 



— + log 1 + JT 4 , (54) 
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where the last inequality holds because we have from that 

\ogPg = H(V)+ log Pm 

Meg 9 

< H(V)+ V ^logP max 
— re 

= ff(7>)+logP max . (55) 
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